fix(service-worker): Strips sensitive headers on cross-origin redirects - #69029
Conversation
| let headers = options.headers; | ||
| const scopeUrl = this.scope.registration.scope; | ||
| if ( | ||
| this.adapter.parseUrl(url, scopeUrl).origin !== |
There was a problem hiding this comment.
This is a workaround to avoid the associated problems mentioned in this comment previously.
#41931 (comment)
JeanMeche
left a comment
There was a problem hiding this comment.
AGENT: The PR correctly and successfully addresses the security concern by stripping Authorization, Proxy-Authorization, and Cookie headers when an intercepted request is redirected to a different origin. The logic perfectly aligns with the WHATWG Fetch Spec's HTTP-redirect fetch algorithm.
Changing the options parameter type from RequestInit to Request is safe because newRequestWithMetadata is only ever called internally with Request instances. The manual header cloning with forEach is necessary given that Adapter.newHeaders requires a record instead of a Headers instance. The tests are well-written and correctly cover the new behavior.
I've left one minor performance optimization inline for consideration.
Removes `Authorization`, `Cookie`, and `Proxy-Authorization` headers when a request is redirected to a different origin. This aligns with the Fetch API's redirect algorithm to prevent sensitive information from being sent to third-party origins.
173f62b to
423a109
Compare
|
@alan-agius4 @JeanMeche I don't know if anything else is missing besides this. This is ready, so I can perform the respective backport. |
|
This pull request has been automatically locked due to inactivity. Read more about our automatic conversation locking policy. This action has been performed automatically by a bot. |
Removes
Authorization,Cookie, andProxy-Authorizationheaders when a request is redirected to a different origin. This prevent sensitive information from being sent to third-party origins.See https://fetch.spec.whatwg.org/#http-redirect-fetch
More context : https://issuetracker.google.com/issues/516064418